Changelog

New

• A second agent harness, behind a flag. pi (pi-agent-core) now runs in-process in the sandbox alongside OpenCode, selected per project by the pi_harness feature flag. It implements abort-after-tool so Quick Queue can stop a turn at a tool boundary, and it enforces the same per-pattern permission rules OpenCode applies. Off unless a project opts in, so nothing changes for existing projects.

Improved

• The pi_harness setting reads correctly in all nine languages.
• Internal: the sandbox daemon's timing budgets now tolerate a slow machine during a process respawn, so a correct restart is no longer reported as a failure.

Fixed

• Restored the load-balancer response-time alarms required by the Drata DCF-86 control.

What's Changed

• feat(kortixd): pi harness — pi-agent-core in-process as a second HarnessDefinition by @DimitrijeGlibic in https://github.com/kortix-ai/suna/pull/7332
• chore(release): staging VERSION → 0.13.24 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7371
• chore(release): VERSION → 0.13.24 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7372
• fix(drata-294): add ALB TargetResponseTime alarms (DCF-86 system monitoring) by @agent-kortix in https://github.com/kortix-ai/suna/pull/7328
• test(kortixd): budget the first-ready waits for a real respawn on a loaded runner by @markokraemer in https://github.com/kortix-ai/suna/pull/7376
• chore(staging): bring staging to main (pi harness behind a flag, 14 commits) by @markokraemer in https://github.com/kortix-ai/suna/pull/7375
• Release v0.13.24 — The pi agent harness, behind a per-project flag by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7377

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.23...v0.13.24

New

• Choose which account a connector runs as, per call. A connection now carries the accounts you may run it as, and the account is chosen when the connector is called rather than pinned to the whole session. The connector catalog, the SDK and the CLI all report the available accounts and the pinned default, and connectors/describe shows accounts instead of only tool counts.
• An ambiguous connector call is refused, not guessed. When several accounts are reachable and none is named or pinned as default, the call is denied with account_required instead of silently picking one — no more mail sent from the wrong mailbox.
• Choosing a connector account is discoverable in the CLI rather than a dead end.

Improved

• A connector you have your own accounts for reads as connected, not "needs setup", and the admin connector list now agrees with what each caller can actually reach.
• Connector accounts are per connection instead of a connector-level strategy, and connections the old strategy flag made unreachable are revoked.
• The sandbox daemon's internals were reorganised behind explicit service boundaries, with its HTTP controllers separated from its adapters.

Fixed

• A failed identity check no longer signs you out. A failed getUser round trip used to end the browser session; it no longer does, and the new-connection screen offers Upgrade when you are at the project cap.
• Connector authorization: finalizing a connection that the whole project can use now requires the connections-manage capability, matching the gate the connect step already applied. Previously a role with connector-write but not connections-manage could complete a project-wide shared connection.
• Auto-created connections no longer claim to be the default, and the CLI's account column no longer truncates away the pinned-default marker.
• Stale connector banner copy and a dead connector detail shell removed; the account list renders for every direct provider.

What's Changed

• fix(auth): a failed getUser round trip no longer signs the browser out; /new offers Upgrade at the project cap by @markokraemer in https://github.com/kortix-ai/suna/pull/7352
• refactor(connectors): credentials are a call-time choice — one access rule, no session gate, no strategy flag by @markokraemer in https://github.com/kortix-ai/suna/pull/7326
• refactor(kortixd): introduce internal harness service boundaries by @DimitrijeGlibic in https://github.com/kortix-ai/suna/pull/7220
• test(api): wait for the second lifecycle drain instead of a 200 ms margin by @markokraemer in https://github.com/kortix-ai/suna/pull/7357
• fix(connectors): account-aware modal header, dead ConnectorDetail shell removed, reconcile re-activates a revoked account by @markokraemer in https://github.com/kortix-ai/suna/pull/7360
• fix(build): quick-queue snapshot uses a reverse scan, unbreaking API typecheck on main by @markokraemer in https://github.com/kortix-ai/suna/pull/7368
• fix(security): connect/finalize gates a project-owned account on connections.manage by @markokraemer in https://github.com/kortix-ai/suna/pull/7366
• chore(staging): bring staging to main (connector-creds, git-connection-logout, 48 commits) by @markokraemer in https://github.com/kortix-ai/suna/pull/7356
• Release v0.13.23 — Per-call connector accounts, no more guessed account, and a sign-out fix by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7370

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.22...v0.13.23

New

• Private provider key pools. Bring several keys for one provider, keep them private or share them with named members, and let each session hold its own key. Sessions fail over to the next key and report the earliest retry time when a pool is exhausted. Gemini and ChatGPT keys pool too, and pooled keys are managed in Models. Pool access is bound to the session owner, and a pool is checked against the model you actually picked.
• Print a whole conversation. Cmd+P prints the full session as a clean document — every message, not one clipped screen of the app.
• Queued prompts you can see and edit. Queued messages show in a list above the composer. Press Up to edit the last one, and Resume picks the queue back up.
• Microsoft Teams install reports what happened. One-click install publishes in the background, lands on Channels with a real status, and offers a retry with the actual reason when publishing fails.
• Astra is available as a ChatGPT subscription model.

Improved

• Faster project boot. New sessions fetch the project from storage instead of cloning it, and start sooner.
• Faster session lists. A project's session list is now a page, not the whole inventory.
• Menus open instantly — menus, popovers, tooltips and the command palette no longer wait to appear.
• Smaller sandbox images, which start faster.
• Git connections are organized per account, with one instance backend and an identity that cannot drift. Verifying with GitHub no longer signs you out, and the new-connection screen always has a way out.

Fixed

• Microsoft Entra directory sync. Patches apply atomically, large directories paginate, groups survive while a user is inactive or a sign-in session is stale, deactivation and single-member removal behave correctly, and users resolve across the whole directory.
• The gateway retries a slow internal call instead of answering "Gateway unavailable".
• Composer drafts survive session startup, and opening session settings no longer closes itself while the composer takes focus.
• One session lifecycle drain at a time per API task, so queued work is not claimed twice.
• Session attachments are more reliable, and model prices show correctly in the ChatGPT picker.
• Security hardening across session cursors, webhook signing keys, and the remaining high-severity scanner findings.
• Database migrations apply cleanly on staging and production.

What's Changed

• fix(teams): one-click install publishes in the background, records its outcome, and shows it by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/7341
• fix(api): run one session lifecycle drain at a time per API task by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7343
• fix(api): run one session lifecycle drain at a time per API task (staging) by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7344
• fix(git): verify-with-GitHub no longer signs out; /new is a git account manager with a way out by @markokraemer in https://github.com/kortix-ai/suna/pull/7330
• chore(release): staging VERSION → 0.13.22 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7347
• chore(release): VERSION → 0.13.22 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7348
• Default pooled provider connections to project access by @markokraemer in https://github.com/kortix-ai/suna/pull/7345
• chore(staging): bring staging to main (resolve the diverged double-shipped hotfixes) by @markokraemer in https://github.com/kortix-ai/suna/pull/7351
• Release v0.13.22 — Private provider key pools, print whole conversations, and Entra SCIM fixes by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7355

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.21...v0.13.22

Fixed

• Projects with thousands of sessions no longer slow the app down. The session list now loads one page at a time — 50 sessions, with a Load more control — instead of returning every session on every refresh. On a project with 12,617 sessions that is a 46 KB response instead of about 11 MB, and the sidebar was refreshing it every five seconds.
• Opening, sharing, stopping, restarting or renaming a session now works however old the session is. These controls used to look the session up in the full list, so once a project grew past the first page the controls could quietly disappear.

Improved

• Date grouping (Today, This week, Older), filters and search work as before, applied to the sessions you have loaded.
• A new database index serves the paged list, so a request no longer sorts every session in the project.

Security

• The pagination cursor is encrypted and tied to both the project and the person viewing it. It cannot reveal a session they are not allowed to open, and it cannot be reused by anyone else.

What's Changed

• Release v0.13.20 — Faster session lists in large projects by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7316

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.19...v0.13.20

• Fix terminal connections that fail after a sandbox resumes because its provider credentials have changed.
• Refresh rejected provider credentials once for reads and discard stale credentials after a failed WebSocket handshake.
• Preserve application redirects and sandbox authentication errors. Do not replay writes when provider authentication fails.

What's Changed

• chore(release): staging VERSION → 0.13.19 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7284
• fix: release provider credential recovery after sandbox resume by @markokraemer in https://github.com/kortix-ai/suna/pull/7287
• Release v0.13.19 — Reliable terminal connections after sandbox resume by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7288

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.18...v0.13.19

Fixed

• Terminal opens on a stopped workspace. Opening Terminal requests a wake even before the first shell exists. Connection retries have a deadline and preserve shell output.
• Session switches keep message retries in the right workspace. Missing conversations stop repeated 404 or 410 requests without clearing cached history.
• Sessions keep their own agent. A session could be switched to an agent from a different project after a prompt that named no agent, which removed its access to connectors and the Kortix CLI. Every session now always runs as its own agent, and a session that was affected recovers on its next message.
• The first message on the home screen no longer gets stuck in the composer after a slow start.
• Project pages load cleanly. The project home shows the Kortix mark while it loads instead of a flashing placeholder.
• Session history is saved before a session stops, and responses from the in-sandbox model proxy are no longer returned in a corrupted encoding.
• Admin project list shows each project's own session counts.
• Customize settings show what you saved. After saving an agent or connector setting, a reload could show the previous value for up to a minute.

Improved

• Connector activity uses consistent names. Connector calls appear as connector calls.
• Repository access is explicit. Agents now declare whether a session gets the project's files, replacing the older workspace modes. Older API clients keep reading restricted manifests correctly.
• Previews route correctly and set up shared sandboxes in isolation.
• Release checks are more reliable: preview environments use their own database, confirm the running runtime, and wait for completed agent artifacts before asserting on them. They also verify cold terminal wake and session-switch routing, allocate sufficient preview frontend memory, and check Docker readiness.

What's Changed

• chore(release): VERSION → 0.13.16 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7249
• chore(release): VERSION → 0.13.17 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7253
• Replace workspace modes with explicit repository access by @markokraemer in https://github.com/kortix-ai/suna/pull/7240
• fix(preview): a legacy HS256 session opens preview origins again by @markokraemer in https://github.com/kortix-ai/suna/pull/7258
• fix(web): a timed-out first prompt no longer stays in the home composer by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7254
• fix(web): project home loading paints the Kortix mark, not a skeleton by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7263
• fix(api): session tokens no longer adopt another project's agent by @markokraemer in https://github.com/kortix-ai/suna/pull/7262
• Release candidate: main 3e7d039e97 → staging by @markokraemer in https://github.com/kortix-ai/suna/pull/7266
• chore(release): VERSION → 0.13.18 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7269
• chore(release): staging VERSION → 0.13.18 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7270
• hotfix(staging): editor manifest reads are fresh on every replica; release setup polls retry transport errors by @markokraemer in https://github.com/kortix-ai/suna/pull/7273
• fix(web): connector tool calls say "connector", not "app" by @markokraemer in https://github.com/kortix-ai/suna/pull/7272
• fix(api): Customize editor reads show the committed manifest on every replica by @markokraemer in https://github.com/kortix-ai/suna/pull/7274
• hotfix(staging): dismiss the welcome card before Save in the repository-access journey by @markokraemer in https://github.com/kortix-ai/suna/pull/7275
• fix: release terminal recovery and session-bound message retries by @markokraemer in https://github.com/kortix-ai/suna/pull/7279
• hotfix(staging): GW-ACCESS-1 accepts the upstream 503 for an unknown model on deployed targets by @markokraemer in https://github.com/kortix-ai/suna/pull/7280
• Release v0.13.18 — Sessions keep their own agent, and explicit repository access by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7271

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.17...v0.13.18

Fixed

• Previews open again when you are signed in. A sandbox preview opened from a session (prod-p<port>-sbx-….p.kortix.com) showed "Sign in to open this preview" even though you were signed in. Sign-in tokens are still issued with the older HS256 signature while the published key set already holds the newer ES256 key. The API already verified those tokens with the auth server, but the preview gate refused them. It now makes the same check, so the preview panel, pasted preview links, and preview WebSockets open for the account that owns the sandbox. A forged or expired token is still refused, and a test now fails if any verifier caller handles these results in its own way.

Internal

• The release gate quarantines TUN-6 on deployed targets only: Bun's WebSocket client sends no User-Agent, so the edge firewall refuses the tunnel handshake on staging and prod. The flow still runs locally.

What's Changed

• chore(release): staging VERSION → 0.13.16 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7248
• chore(release): staging VERSION → 0.13.17 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7252
• test(release): quarantine TUN-6 — Bun WebSocket handshake has no User-Agent, WAF 403s it on staging/prod by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/7255
• hotfix(preview): a legacy HS256 session opens preview origins again by @markokraemer in https://github.com/kortix-ai/suna/pull/7259
• Release v0.13.17 — Signed-in previews open again by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7261

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.16...v0.13.17

New

• Project-level provider and model access controls. Owners and admins choose which model providers and which models a project may use, from one model management view that also holds provider links. Kortix managed models sit beside your own providers in the same list, a ChatGPT subscription shows its access beside its credentials, and the picker distinguishes "not shown" from "blocked" so a member sees why a model is unavailable.
• GPT-6 Astra is in the managed catalog. Select kortix/gpt-6-astra with image input, tools, and the supported reasoning efforts. Routing, prices, capability limits, and sandbox fallbacks are all in step.
• The desktop app always has a way out. The shell has no browser toolbar, so a page without an in-app exit was a dead end. Every such page now has Close, the Go menu has Back (Cmd/Ctrl+[) and Home (Cmd/Ctrl+Shift+H), a renderer crash offers Reload or Go Home instead of an empty window, and the Electron route allowlist now matches the web middleware's exactly.

Improved

• One noun: project. The interface said "workspace" while the SDK, CLI, API, routes, manifest, and docs all said "project". Screen copy now says project in every one of the nine languages, each with its own word rather than a find-and-replace. The sandbox /workspace directory, the manifest's per-agent workspace: boundary, and Slack workspaces keep their names.
• Create a project in a specific account. The Switch project menu, already grouped by account, gains a "Create a project in {account}" row for each account where you are an owner or admin, including accounts that have no projects yet. The old global link never said which account it would land in.
• The SSO and SCIM setup wizards work again. Picking a provider did nothing, and Back or the step rail snapped you to the first step with a render loop in the console. Both are fixed, and a browser journey now walks every step of both wizards on every deploy.
• Tunnel file transfers are verified end to end. Binary files sent through the Computer Tunnel are checked by digest at the destination, an approval for one exact file no longer grants its parent directory, permission decisions are serialized so an approve and a deny cannot both win, and orphaned upload tasks are stopped.

Fixed

• The sandbox model proxy asked upstream for compressed responses and could not decode them. It now requests identity encoding, so a session on a model that answered with zstd no longer fails its first turn.

Internal

• Project snapshot config provider v2 (S3). Sessions can boot from a prebuilt, blob-less snapshot of the project's committed tree with the history hydrated off the boot path, falling back to Git when no snapshot is ready. Every environment gets a private snapshot bucket and the task-role grant; only staging names its bucket, so production sessions keep the Git path until the in-region measurement lands.
• The project-snapshot task role gets s3:ListBucket, so a missing object is a 404 and not a denied build, and the grant is gated on a plan-time boolean so terraform plan succeeds on a root that creates the bucket in the same apply.
• The deployed release gate's contracts were corrected for previews: marketing stays enabled while the browser gate exercises /pricing, App domains are not expected on a sandbox origin, cold Daytona boots get a budget above their measured image builds, encoded-path probes accept the exact auth redirect, and the project submenu is required before a row is selected.
• The connector connection-flow routing change (#7074) was merged and reverted within the same window; it ships no behavior.

What's Changed

• feat(web): route connector connection flows by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7074
• feat: S3 project-snapshot config provider v2 — blob-less boot object + hydrated blob pack, Git fallback (local-verified; AWS/staging deferred) by @DimitrijeGlibic in https://github.com/kortix-ai/suna/pull/7221
• fix(infra): project-snapshot grant count known at plan time (unblocks Deploy Dev) by @markokraemer in https://github.com/kortix-ai/suna/pull/7232
• Revert "feat(web): route connector connection flows" (#7074) by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7235
• fix(infra): project-snapshot task role gets s3:ListBucket (dev producer 403) by @markokraemer in https://github.com/kortix-ai/suna/pull/7237
• fix(web): one noun — project — and a way to create one in a specific account by @markokraemer in https://github.com/kortix-ai/suna/pull/7229
• fix(web): SSO and SCIM setup wizards advance past the provider picker again by @markokraemer in https://github.com/kortix-ai/suna/pull/7239
• fix(tunnel): verify binary file delivery and permission decisions by @markokraemer in https://github.com/kortix-ai/suna/pull/7241
• Add project provider and model access controls by @markokraemer in https://github.com/kortix-ai/suna/pull/7233
• feat(models): add GPT-6 Astra to Kortix by @Ino-Bagaric in https://github.com/kortix-ai/suna/pull/7245
• fix(desktop): remove desktop soft locks — Close, Go Back/Home, crash recovery by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7246
• Release main to staging — September 15 candidate by @markokraemer in https://github.com/kortix-ai/suna/pull/7244
• Release v0.13.16 — Project model access controls, GPT-6 Astra, and a desktop app you can always leave by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7250

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.15...v0.13.16

New

• Review Center is on for every project. It is no longer behind a feature flag — the routes, registry, contract, web surfaces, CLI, and docs all ship it by default.
• A public App can recognise you. public used to mean both "anyone with the link may open this" and "nobody is ever recognised". Now an App you share outside your company still greets your own team, shows them the controls a visitor should not see, and records who acted.

Improved

• Creating an account is reachable again, and it lands you in the account you created. The control had no live entry point, and the one path that reached it dropped you back where you started. There is now a "Create an account…" row in the workspace switcher, and creating an account opens its first workspace with that account selected.
• Connector categories show their true size. The catalogue counted one page of results and headed every category with "· 1". Categories are now grouped over the complete catalogue on the server, and "View all" filters to the set its heading counted.
• Secret intake forms read better. Field hints written by an agent become real links, every non-form step shares one status notice, and the header no longer runs under the close button.
• Modals opened over modals stack correctly. A modal opened while another was open could render underneath it; it now takes the layer above, and the switch control meets contrast in both themes.
• Session hover cards line up. Sessions carrying a Slack, schedule, or shared marker opened their card inset from the sidebar edge; every row now anchors at the same place.

Fixed

• Sending a message no longer makes the transcript jump twice. An idle send moved the view down and then glided it back. The send is now recognised as the working turn, so the view moves once.

Internal

• 4xx denials are logged as warnings, not errors. Roughly 43% of production error-level lines were expected denials — expired tokens, a project-scoped token refused a cross-project read, an agent missing a grant — which buried real faults. Severity now follows the status class; the lines stay queryable and Sentry behaviour is unchanged.
• A dropped audit batch now says why. The log recorded the whole failing statement plus its bound parameters — IP addresses, user agents, account and project ids — while hiding the SQLSTATE that distinguishes a transient timeout from a permanent constraint violation. It now reports the code and cause, with no statement text and no parameters.
• A forced test exit raises a workflow annotation instead of a line buried in a 40,000-line CI log.
• The staging deploy asserts the host-only access cookie from main, matching what staging already checked.

What's Changed

• feat(apps): a public App can recognise you without shutting anyone else out by @markokraemer in https://github.com/kortix-ai/suna/pull/7197
• chore(release): staging VERSION → 0.13.15 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7211
• chore(release): VERSION → 0.13.15 [skip ci] by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7212
• fix(web): stack modals opened over open modals; Switch hover contrast by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7213
• fix(web): anchor every session hover card at the same edge by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7214
• ci(deploy-staging): main must assert the host-only access cookie, like staging already does by @markokraemer in https://github.com/kortix-ai/suna/pull/7209
• chore: back-merge staging into main — 12 commits that are in production but not on the trunk by @markokraemer in https://github.com/kortix-ai/suna/pull/7217
• feat: graduate Review Center out of the feature-flag system by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7216
• fix(connectors): show true category sizes in the Connectors catalogue by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7215
• fix(tests): a forced exit must raise an annotation, not a line nobody reads by @markokraemer in https://github.com/kortix-ai/suna/pull/7218
• fix(audit): say WHY a dropped audit batch failed, and stop logging its payload by @markokraemer in https://github.com/kortix-ai/suna/pull/7222
• fix(api): a 4xx denial is a warning, not an error by @markokraemer in https://github.com/kortix-ai/suna/pull/7223
• fix(session): sending a message moves the transcript once, not twice by @sutharjay1 in https://github.com/kortix-ai/suna/pull/7225
• fix(web): make account creation reachable, and land in the account you created by @markokraemer in https://github.com/kortix-ai/suna/pull/7224
• release: main → staging (v0.13.15 candidate) by @markokraemer in https://github.com/kortix-ai/suna/pull/7226
• Release v0.13.15 — Account creation you can find, Review Center for everyone, and a steadier session view by @github-actions[bot] in https://github.com/kortix-ai/suna/pull/7227

Full Changelog: https://github.com/kortix-ai/suna/compare/v0.13.14...v0.13.15